2095 matches found
CVE-2024-51736 Command execution hijack on Windows with Process class in symfony/process
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijackin...
Symfony vulnerable to command execution hijack on Windows with Process class
Description On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. Resolution The Process class now uses the absolute path to cmd.exe. The patch for this...
GHSA-QQ5C-677P-737Q Symfony vulnerable to command execution hijack on Windows with Process class
Description On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. Resolution The Process class now uses the absolute path to cmd.exe. The patch for this...
Symfony vulnerable to open redirect via browser-sanitized URLs
Description The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. Resolution The Request::create methods now assert the URI does not contain invalid...
GHSA-MRQX-RP3W-JPJP Symfony vulnerable to open redirect via browser-sanitized URLs
Description The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. Resolution The Request::create methods now assert the URI does not contain invalid...
Symfony has an incorrect response from Validator when input ends with `\n`
Description It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Resolution Symfony now uses the D regex modifier to match the entire input. The patch for this issue is available here for branch 5.4. Credits We would li...
GHSA-G3RH-RRHP-JHH9 Symfony has an incorrect response from Validator when input ends with `\n`
Description It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Resolution Symfony now uses the D regex modifier to match the entire input. The patch for this issue is available here for branch 5.4. Credits We would li...
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Description When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. Resolution The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. The fisrt patch for this issue is...
GHSA-9C3X-R3WP-MGXM Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Description When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. Resolution The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. The fisrt patch for this issue is...
Symfony's `Security::login` does not take into account custom `user_checker`
Description The custom userchecker defined on a firewall is not called when Login Programmaticaly with the Security::login method, leading to unwanted login. Resolution The Security::login method now ensure to call the configured userchecker. The patch for this issue is available here for branch...
GHSA-JXGR-3V7Q-3W9V Symfony's `Security::login` does not take into account custom `user_checker`
Description The custom userchecker defined on a firewall is not called when Login Programmaticaly with the Security::login method, leading to unwanted login. Resolution The Security::login method now ensure to call the configured userchecker. The patch for this issue is available here for branch...
Symfony allows changing the environment through a query
Description When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. Resolution The SymfonyRuntime now ignores the argv values for non-cli...
GHSA-X8VP-GF4Q-MW5J Symfony allows changing the environment through a query
Description When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. Resolution The SymfonyRuntime now ignores the argv values for non-cli...
Misinterpretation of Input
Overview Affected versions of this package are vulnerable to Misinterpretation of Input containing a \n. Several validations expect line ending characters to be matched by $, but a malicious user can bypass those validations to cause invalid input to be treated as valid. Remediation Upgrade...
Insertion of Sensitive Information Into Sent Data
Overview symfony/http-client is a Symfony HttpClient component. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the request function in NoPrivateNetworkHttpClient, used during host resolution. This can be exploited to enumerate ports or IP...
Open Redirect
Overview symfony/http-foundation is a component defines an object-oriented layer for the HTTP specification. Affected versions of this package are vulnerable to Open Redirect in the Request::create function, which improperly handles special characters in a URI. Remediation Upgrade...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection by replacing cmd.exe or placing a fake one in the working directory, which will be executed by ExecutableFinder.php when preparing command arguments. Note: This vulnerability only affects applications running on...
Access Restriction Bypass
Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Access Restriction Bypass when constructing functions in SymfoyRuntime.php, which allows the user to change environment or debug mode by...
Improper Authorization
Overview symfony/security-bundle is a security bundle for Symfony. Affected versions of this package are vulnerable to Improper Authorization in the createFirewall function in SecurityExtension.php, which does not apply userchecker during programmatic login. Remediation Upgrade...
PT-2024-34151 · Symfony +2 · Symfony/Securitybundle +2
Name of the Vulnerable Software and Affected Versions: symfony/security-bundle versions prior to 6.4.10 symfony/security-bundle versions prior to 7.0.10 symfony/security-bundle versions prior to 7.1.3 Description: The custom user checker defined on a firewall is not called when logging in...